commit bc9df334b73b03346e6acae74f2f82cfd4a8b83b
Author: Jiping Ma <email address hidden>
Date: Fri Oct 7 23:23:43 2022 -0400
Debian: Place module signing keys in a separate package
Currently we package our module signing keys as part of
the 'linux-kbuild' package. This means that anyone obtaining
our 'linux-kbuild' package, which we do publish, can produce
signed modules. This violates the intent of secure boot.
Re-package our module signing keys into a separate package
known as 'linux-keys'.
Testing:
- Build all out of tree modules successfully.
- An ISO image can be built out successfully.
- Installation of the ISO image is successful with standard and
low-latency profiles.
- The out of tree modules can be loaded successfully when secure boot is
enabled.
- Make sure there are not the keys in the lab that installed
with the ISO image.
Closes-Bug: 1992214
Signed-off-by: Jiping Ma <email address hidden>
Change-Id: I73e80b5869ebdc8b57771b7f016d9c9037a0d512
Reviewed: https:/ /review. opendev. org/c/starlingx /kernel/ +/861822 /opendev. org/starlingx/ kernel/ commit/ bc9df334b73b033 46e6acae74f2f82 cfd4a8b83b
Committed: https:/
Submitter: "Zuul (22348)"
Branch: master
commit bc9df334b73b033 46e6acae74f2f82 cfd4a8b83b
Author: Jiping Ma <email address hidden>
Date: Fri Oct 7 23:23:43 2022 -0400
Debian: Place module signing keys in a separate package
Currently we package our module signing keys as part of
the 'linux-kbuild' package. This means that anyone obtaining
our 'linux-kbuild' package, which we do publish, can produce
signed modules. This violates the intent of secure boot.
Re-package our module signing keys into a separate package
known as 'linux-keys'.
Testing:
- Build all out of tree modules successfully.
- An ISO image can be built out successfully.
- Installation of the ISO image is successful with standard and
low-latency profiles.
- The out of tree modules can be loaded successfully when secure boot is
enabled.
- Make sure there are not the keys in the lab that installed
with the ISO image.
Closes-Bug: 1992214
Signed-off-by: Jiping Ma <email address hidden> 8b57771b7f016d9 c9037a0d512
Change-Id: I73e80b5869ebdc